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Abstract — Wyner's work on wiretap channels and the recent 
works on information theoretic security are based on random 
codes. Achieving information theoretical security with practical 
coding schemes is of definite interest. In this note, the attempt 
is to overcome this elusive task by employing the polar coding 
technique of Arikan. It is shown that polar codes achieve non- 
trivial perfect secrecy rates for binary-input degraded wiretap 
channels while enjoying their low encoding-decoding complexity. 
In the special case of symmetric main and eavesdropper chan- 
nels, this coding technique achieves the secrecy capacity. Next, 
fading erasure wiretap channels are considered and a secret key 
agreement scheme is proposed, which requires only the statistical 
knowledge of the eavesdropper channel state information (CSI). 
The enabling factor is the creation of advantage over Eve, 
by blindly using the proposed scheme over each fading block, 
which is then exploited with privacy amplification techniques to 
generate secret keys. 

I. Introduction 

The notion of information theoretic secrecy was introduced 
by Shannon to study secure communication over point-to-point 
noiseless channels [1]. This line of work was later extended 
by Wyner [2| to noisy channels. Wyner's degraded wiretap 
channel assumes that the eavesdropper channel is a degraded 
version of the one seen by the legitimate receiver. Under this 
assumption, Wyner showed that the advantage of the main 
channel over that of the eavesdropper, in terms of the lower 
noise level, can be exploited to transmit secret bits using 
random codes. This keyless secrecy result was then extended 
to a more general (broadcast) model in [3| and to the Gaussian 
setting in [4j. Recently, there has been a renewed interest in 
wireless physical layer security (see, e.g., Special Issue on 
Information Theoretic Security, IEEE Trans. Inf. Theory, June 
2008 and references therein). However, designing practical 
codes to achieve secrecy for any given main and eavesdropper 
channels remained as an elusive task. 

In 0, the authors constructed LDPC based wiretap codes 
for certain binary erasure channel (BEC) and binary symmetric 
channel (BSC) scenarios. In particular, when the main channel 
is noiseless and the eavesdropper channel is a BEC, 
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presented codes that approach secrecy capacity. For other 
scenarios, secrecy capacity achieving code design is stated 
as an open problem. Similarly, [6| considers the design of 
secure nested codes for the noiseless main channel setting (see 
also 0). 

This work considers secret communication over a binary- 
input degraded wiretap channel. Using the polar coding tech- 
nique of Arikan Jfj), we show that non-trivial secrecy rates 
are achievable. According to our best knowledge, this coding 
technique is the first provable and practical (having low en- 
coding and decoding complexity) secrecy encoding technique 
for this set of channels. In the special case of the symmetric 
main and eavesdropper channels, this technique achieves the 
secrecy capacity of the channel [j. Next, we consider fading 
wiretap channels and propose a key agreement scheme where 
the users only assumed to have the statistical knowledge of 
the eavesdropper CSI. The enabling observation is that by 
blindly using the scheme over many fading blocks, the users 
will eventually create an advantage over Eve, which can then 
be exploited to generate secret keys using privacy amplification 
techniques. 

II. Notations 

Throughout this paper, vectors are denoted by x^ = 
{xi,--- ,xn} or by x if we omit the indices. Random 
variables are denoted with capital letters X, which are defined 
over sets denoted by the calligraphic letters X. For a given set 
Ac {1, • • • , N}, we write xj± to denote the sub-vector [xi : 
i G A}. Omitting the random variables, we use the following 
shorthand for probability distributions p(x) — Pr(X = x), 
p(x\y) 4 PrpT = x\Y = y). 

III. Polar Codes 

Consider a binary-input DMC (B-DMC) given by W(y\x), 
where x £ X — {0, 1} and y G y for some finite set y. The 
N uses of W is denoted by W N (y^\x^). The symmetric 

'We acknowledge that the concurrent work |9| independently established 
the result that polar codes can achieve the secrecy capacity of the degraded 
wiretap channels, when both main and eavesdropper channels are binary-input 
and symmetric (Corollary [7] of this note). 



capacity of a B-DMC W is given by 



(1) 



which is the mutual information I(X; Y) when the input X 
is uniformly distributed. The Bhattacharyya parameter of W 
is given by 



Z{W) 4 V ^/W(y\0)W(y\l), 



yey 



(2) 



which measures the reliability of W as it is an upper bound 
on the probability of ML decision error on a single use of the 
channel. 

Polar codes is recently introduced by Ankan [8|. These 
codes can be encoded and decoded with complexity 
0(N log N), while achieving an overall block-error proba- 
bility that is bounded as 0(2~ N ) for any fixed (3 < ^ 
([8 1, [ 10 1). In [8|, channel polarization is used to construct 
codes (polar codes) that can achieve the symmetric capacity, 
I(W), of any given B-DMC W. Channel polarization consists 
of two operations: Channel combining and channel splitting. 
Let be the vector to be transmitted. The combined channel 
is represented by Wn and is given by 

W N (yi~K) = W N {y?\u?B N F® n ), (3) 

where Bm is a bit-reversal permutation matrix, N = 2", and 

F = ^ j 1 y Note that the actual channel input here is 

given by x 1 ^ = BmF® u . The channel splitting constructs 
N binary input channels from Wn, where the transformation 
is given by 



The polarization phenomenon is shown by the following 
theorem. 

Theorem 1 (Theorem 1 of 18]): For any B-DMC W, N = 
2 n for some n, and S £ (0, 1), we have 

Hm \{i £ {1, ■ ■ ■ ,iV} : I{W$) e {1- 5, 1]} = 

N-tcc N 



lim 



\{ie{l,---,N}:I(wjl ) )(=[0,6)}\ 
N 



1-I(W). 



Now, the idea of polar coding is clear. The encoder-decoder 
pair, utilizing the polarization effect, will transmit data through 
the subchannels for which Z(W^ ) is near 0. In (8), the 
polar code (N,K,A,u A °) for B-DMC W is defined by 
xf = Ui BiyF® n , where is a given frozen vector, and 
the information set A is chosen such that \A\ = K and 
Z(W$) < Z(W { jp) for all i £ A, j £ A c . The frozen vector 
u_A" is given to the decoder. Arikan's successive cancellation 
(SC) estimates the input as follows: For the frozen indices 
UA a — u^- For the remaining indices s.t. i £ A; Ui = 0, if 
W$(y? ,ui _1 |0) > W4 i) (yf r ,wi" 1 |l) and Ui = 1, otherwise. 
With this decoder, it is shown in [8] that the average block 
error probability over the ensemble (consisting of all possible 
frozen vector choices) of polar codes is bounded by 

P B (iV) < 5>(W$). 
ieA 

We now state the result of [8 1 using the bound given in iflOl . 

Theorem 3 (Theorem 2 of MOV ): For any given B-DMC W 
with I(W) > 0, let R < I{W) and p £ (0, ±) be fixed. Block 
error probability for polar coding under SC decoding (averaged 
over possible choices of frozen vectors) satisfies 

P e (N)=0(2- NP ). 

Note that, for any given p £ (0, h) and e > 0, we can 
define the sequence of polar codes by choosing the information 
indices as 

1 

N' 

Then, from the above theorems, for sufficiently large N, we 
can achieve the rate 

\A N \ 



In order to derive the rate of the channel polarization, the 
random process Z n is defined in (8| and in HI 0H . Basically, 

Pr^eiaM}- 111 ^ 1 ^-^'^^^ (5) 
The rate of the channel polarization is given by the following. 

Theorem 2 (Theorem 1 of ilTOl/): For any B-DMC W and 
for any given p < |, 

lim Pi{Z n < 2- 2 ""} = I{W). 



A 



N 



{ J £{l,.--,iV}:Z(< l) )<^2- JvP }. 



R 



N 



> I(W) 



with average block error probability (averaged over the possi- 
ble choices of 

Pe(N) < Z{W^) < 2- w " 

under SC decoding. (See also HI].) 

This result shows the existence of a polar code 
(N, K, A, ) achieving the symmetric capacity of W . We 
remark that, any frozen vector choice of u^c will work for 
symmetric channels |8|. For our purposes, we will denote a 
polar code for B-DMC W with C(N, J 7 , wjr), where the frozen 
set is given by T = A c . Note that, A denotes the indices of 
information transmission for the polar code, whereas T is the 
set of frozen indices. 

We conclude this section by noting the following lemma 
(given in ifTTl ) regarding polar coding over degraded channels. 

Lemma 4 (Lemma 4.7 of 4771/ ): Let W : X -> y and W : 
X -> y' be two B-DMCs such that W is degraded w.r.t. W, 
i.e., there exists a channel W" : y' — > y such that 

W(y\x) = W'(y'\x)W"(y\y'). 
y'ey 



Then, W£> is degraded w.r.t. W' N and Z{W N l) ) > Z(W 



N 



IV. Secure Transmission over Wiretap Channel 
A discrete memoryless wiretap channel with is denoted by 

(X, W(y m ,y e \x),y m xy e ), 

for some finite sets X,y m ,y e . Here the symbols x G X 
are the channel inputs and the symbols (y m ,y e ) e y m x y e 
are the channel outputs observed at the main decoder and at 
the eavesdropper, respectively. The channel is memoryless and 
time-invariant: 

p{y mt ,ye l \x\,y m T 1 ,ye l f 1 ) = W (y mi , y ei \zi) ■ 

We assume that the transmitter has a secret message M which 
is to be transmitted to the receiver in TV channel uses and 
to be secured from the eavesdropper. In this setting, a secret 
codebook has the following components: 

1) The secret message set M.. The transmitted messages are 
assumed to be uniformly distributed over these message sets. 

2) A stochastic encoding function /(.) at the transmitter 
which maps the secret messages to the transmitted symbols: 
/ : m —> X^ for each m G A4. 

3) Decoding function </>(.) at receiver which maps the 
received symbols to estimate of the message: <fi(Y m ^) — {m}. 

The reliability of transmission is measured by the following 
probability of error. 

P * = TM E Pr{^mf)^(m)|(m)issent} 

We say that the rate R is an achievable secrecy rate, if, for 
any given e > 0, there exists a secret codebook such that, 

ilog(|A4|) = R 

Pe < e 

l/(M;y e f) < 6 (6) 

for sufficiently large N. 

Consider a degraded binary-input wiretap channel, where, 
for the input set X = {0, 1}, the main channel is given by 

W m (y m \x) (7) 

and the eavesdropper channel is 

W e {y e \x)= W m {y m \x)W d (y e \y m ). (8) 

y m ey m 

Here, the degradation is due to the channel Wd(y e \ym)- 

Note that, due to degradation, polar codes designed for the 
eavesdropper channel can be used for the main channel. For 
a given sufficiently large N and f3 e (0, A), let 

An = {* € {1, • • • , N} : Z(W m %) < jj2- N *}, 

A e = {i e {1, • • • ,N} : Z(W®) < ^2- NP }. 

Now, consider a polar code C m = C(N,J 7 m ,ujr m ) for the 
main channel with some Uj? m . Due to Lemma [4] we have 
A e C A m and hence T m C J- e - Now, for any given 



length \J : e \ — \J- rn \ vector v m and ur m , we define the 
frozen vector for the eavesdropper, denoted by ujr e (v m ), by 
choosing {ur e (v m ))j^ m = u Tm and (u^ t (ti m ))y t \j m = v m . 
Note that, denoting C e (v m ) = C(N, J- e , ujr B (v m )), the en- 
semble Dv m .u :Fm Ce(vm) is a symmetric capacity achieving 
polar code ensemble for the eavesdropper channel W e (if 
the eavesdropper channel is symmetric, any frozen vector 
choice will work [8 1, and hence the code achieves the capacity 
of the eavesdropper channel for any v m ,ujr m ). This implies 
that the code for the main channel can be partitioned as 
C m — U Sm C e (w m ). This observation, when considered over the 
ensemble of codes, enables us to construct secrecy achieving 
polar coding schemes, even if the eavesdropper channel is not 
symmetric, as characterized by the following theorem. 

Theorem 5: For a binary-input degraded wiretap channel, 
the perfect secrecy rate of I(W m ) — I(W e ) is achieved by 
polar coding. 
Proof: 

Encoding: We map the secret message to be transmitted to 
v m and generate a random vector v r , according to uniform 
distribution over X, of length \A e \- Then, the channel input 
is constructed with x 1 ^ = u^B^F® 71 , where uj? m is the 
frozen vector of the polar code C m , u^ < ,\T m = v m , and 
ua c — v r . The polar code ensemble is constructed over all 
different choices of frozen vectors, i.e., Uj? m . 

Decoding: The vectors v m and v r can be decoded with 
the SC decoder described above with error probability P e = 
0{2- Nf> ) (averaged over the ensemble) achieving a rate R = 
%i = I(W m ) - I (W e ) for sufficiently large N. 

Security: Lets assume that the vector v m is given to 
the eavesdropper along with u? m . Then, employing the SC 
decoding, the eavesdropper can decode the random vector v r 
With P e = 0(2~ N ) averaged over the ensemble. Utilizing 
the Fano's inequality and average it over the code ensemble 
seen by the Eve, i.e. over V m and Uj? m , we obtain 

H(Vr\V m ,UF n ,Y e ?) < H{Pe) + N\og(\X\)Pe < Ne(N), (9) 

where e(N) — > as — ► oo. 

Then, the mutual information leakage to the eavesdropper 
averaged over the ensemble can be bounded as follows. 

J(M;y e f |E7>J = I(V m ;Y e ?\UrJ 

= i{v m ,v r -Ye^\u Fm )-i{y r -Ye^\v m ,u Tm ) (10) 

( =' /(C/f; F e f ) - H(V r ) + H(V r \V m , U Tm , Y e ? )(11) 

(6) 

< I(XF; Y e ? ) - H(V r ) + H(V r \V m , U Tm , Y£ \\2) 

< NI(W e )-\Ae\+H(V r \V m ,Ur m ,Y e ?) (13) 

(d) 

< NI(W e )-\Ae\ + Ne(N), (14) 

where in (a) we have [Tj™ each entry with i.i.d. uniformly 
distributed, (b) follows from data processing inequality, (c) is 

N N 

due to /(XfjYef) = E J^ilni- 1 ) < E H(Y ei ) - 

»=1 i=l 

H(Y ei \Xi) = NI(Xi\Y ei ) with a uniformly distributed Xj, 



and (d) follows from © with e(N) -4 as N — > oo. As 
— > i'(We) as AT gets large, we obtain 

^I(V m ;Y e ?\UrJ < e (15) 

for a given e > for sufficiently large N. As the reliability and 
secrecy constraints are satisfied averaged over the ensemble, 
there exist a polar code with some fixed uj? m achieving the 
secure rate I(W m ) ~ I(W e ). ■ 

Note that in the above result, the code satisfying the reliabil- 
ity and the secrecy constraints can be found from the ensemble 
by an exhaustive search. However, as block length increases, 
almost all the codes in the ensemble will do equally well. 
If the eavesdropper channel is symmetric, then the secrecy 
constraint is satisfied for any given frozen vector ujr m and 
the code search is only for the reliability constraint. If the 
eavesdropper channel is not symmetric, a prefix channel can 
be utilized to have this property. 

Corollary 6: For non-symmetric eavesdropper channels, the 
channel can be prefixed with some p(x\x') such that the 
resulting eavesdropper channel 

W' e (y e \x')= P(x\x')W m (ym\x)W d (y e \y m ) 

y m ey m 

is symmetric. Then, using the scheme above, the secret rate 

R = I(W m ) - I(W' e ) 

is achievable, where W m (y m \x') — p(x\x')W m (y m \x). 
Finally, we note that the scheme achieves the secrecy capacity 
and any code in the ensemble, i.e., any fixed ujr m , will satisfy 
both the reliability and secrecy constraints, if the main and 
eavesdropper channels are symmetric. 

Corollary 7: For a binary-input degraded wiretap channel 
with symmetric main and eavesdropper channels, polar coding 
achieves the secrecy capacity, i.e., C(W m ) — C(W e ), of the 
channel. 

We note that the stated results are achievable by encoders 
and decoders with complexity of 0(N log N) for each. In 
addition, if the channels are binary erasure channels (BECs), 
then there exists algorithms with complexity O(N) for the 
code construction (8). 

V. Secret Key Agreement over Fading Wiretap 
Channels 

In this section, we focus on the following key agreement 
problem: Alice, over fading wiretap channel, would like to 
agree on a secret key with Bob in the presence of passive 
eavesdropper Eve. We focus on the special case of binary 
erasure main and eavesdropper channels, for which the code 
construction is shown to be simple |8|. 

Fading blocks are represented by i = 1, • • • , LM and each 
block has N channel uses. Random variables over blocks are 
represented with the following bar notation. Y e ' denotes 
the observations of Eve over the fading block m of the super 
block I, the observations of Eve over super block I S [1,L] 
is denoted by W = Y^ 1 " ^ 4 {Y^\ ■ ■ • , Y^ M) }, and 



Eve's total observation over all super blocks is denoted by 

y;=f- i )={f) ) ... ) yW}. 

Main and eavesdropper channels are binary erasure channels 

(i) (i) 

and are denoted by W m and We , respectively. Here, the 
channels W m and W e are random, outcome of which result in 
the channels of each block. Instantaneous eavesdropper CSI is 
not known at the users, only the statistical knowledge of it is 
assumed. The channels are assumed to be physically degraded 
w.r.t. some order at each block. @ Note that, in this setup, 
eavesdropper channel can be better than the main channel on 
the average. 

We utilize the proposed secrecy encoding scheme for the 
wiretap channel at each fading block. Omitting the block 
indices, frozen and information bits are denoted as Uj? m and 
u_4 m , respectively. Information bits are uniformly distributed 
binary random variables and are mapped to u^\ m . Secret and 
randomization bits among these information bits are denoted 
by V m and V r , respectively. Frozen bits are provided both to 
main receiver and eavesdropper at each block. (We omitted 
writing this side information below as all zero vector can be 
chosen as the frozen vector for the erasure channel [8|.) Note 
that Alice and Bob do not know the length of Vm at fading 
block i. In particular, there may not be any secured bits at a 
given fading block. 

Considering the resulting information accumulation over a 
block, we obtain the followings. 

±H(V®) = [C(WW)-C(W e W)] + 

where the former denotes the amount of secure information 
generated at block i (here the secrecy level is the bound 
on the mutual information leakage rate), and the latter de- 
notes the remaining information. Note that these entropies are 
random variables as channels are random over the blocks. 
Remarkable, this scheme converts the fading phenomenon 
to the advantage of Alice and Bob (similar to the enabling 
observation utilized in 02)). Exploiting this observation and 
coding over LM fading blocks, the proposed scheme below 
creates advantage for the main users: As L,M,N get large, 
information bits, denoted by W*, are w.h.p. reliably decoded 
at the Bob, H{W*) -> LMNE [C(W m )], and H(W*\Y*) ->• 
LAIN E [[C{Wm] - C(W e )]+]. This accomplishes both ad- 
vantage distillation and information reconciliation phases of a 
key agreement protocol ff3l . fl4l . Now, a third phase (called 
as privacy amplification) is needed to distill a shorter string 
K from W*, about which Eve has only a negligible amount 
of information. The privacy amplification step can be done 
with universal hashing as considered in Hl3l . We first state the 
following definitions and lemma regarding universal hashing, 
and then formalize the main result of this section in the 
following theorem. 

2 Remarkable, a random walk model with packet erasures can be covered 
with this model. Also, parallel channel model is equivalent to this scenario. 



Definition 8: A class Q of functions A —> B is universal if, 
for any xi ^ x 2 in A, the probability that g(x-y) = g(x 2 ) is 
at most rgr when g is chosen as random from Q according to 
the uniform distribution. 

There are efficient universal classes, e.g., to map n bits 
to r bits, class of linear functions given by r x n matrices 
needs rn bits to describe |[T5l . Note that hash function should 
have complexity as 1) it will be revealed to each user, and 2) 
Alice and Bob will compute g(W*). There are more efficient 
classes with polynomial time evaluation complexity and 0(n) 
description complexity lfl5l . 

Generalized privacy amplification, proposed in ifPJl . is 
based on the following property of universal hashing. 

Lemma 9 (Theorem 3, ^7?1/): Let X £ X be a random 
variable with distribution Px and Renyi entropy (of second 
order) R(X) = — log 2 E[Px(X)]. Let G be a random choice 
(according to uniform distribution) of a member of universal 
class of hash functions X — > {0, and let Q = G(X). 
Then, we have 



H(Q\G) > R{Q\G) > r-log 2 1 + 2 



-R{X) 



> r- 



2r-R{X) 
In 2 



Exploiting the proposed coding scheme, which creates ad- 
vantage in favor of Bob over the fading channel, we use the 
hash functions described above and obtain the following result. 

Theorem 10: For any e, e* > 0, let 

n = L M N (E [C(W m )] — e*) , 

r = L M N (E [[C[W m ) - C(W e )}+] - e*) . 

Then, for sufficiently large L, M and N, Alice and Bob can 
w.h.p. agree on the random variable W* = W^ 1 '" L ^ of length 
n over LM fading blocks (i.e., PrjW* ^ W*} < e, where 
W* denotes the estimate at Bob); and choose K = G(W*) 
as their secret key (here G is chosen uniformly random from 
universal class of hash functions {0, 1}™ — > {0, l} r ) satisfying 

I(K;Y;,G) <e, 

where Y* = Y? 1 " denotes the Eve's total received symbols. 
Proof: 

We repeat the described scheme over LM fading blocks. 
Due to the construction above, we have 

±H(yW) -ei < ±H(V«>\YW) < ±H(V«>), (16) 

where ^H(V^) = [C(W$) - C(W^)]+ and e 1 -> as 
N gets large (follows from the fact that conditioning does not 
increase entropy and the security of Vm), and 

lF(yW|yW,y«)<e 2 , 



(17) 



where e 2 — > as N — > oo (follows from Fano's inequality). 

We now consider the total information accumulation and 
leakage. Let W* = 4 {V$ m \ V r (l;m) , VZ G 

[l,L],Vm G [1,M]} and denote the estimate of it at Bob as 



W*. We obtain that, there exist N\,M\, s.t. for any N > N x 
and M > Mi, we have 

H{W*) > LAIN (E [C{W m )\ - e*) (18) 

Vv{W* ^ W*} < LM2~ N \ (19) 

for some j3 <E (0, |) due to polar coding and the union bound. 



at Eve, we write 



Considering Y* = Y^ 1 L%> 

l = = ,, 
H(W*\Y*) = H(WW\Y} 1 ') 
i=i 

LM 

= Y j H{v£\yV)+H{vP\yW,v£>). (20) 
i=i 

Focusing on a particular super block, omitting the index (I) 
in (W^\fj l) ), and using <|T6} and (EJ in {gjj, we obtain 

MiV (-E [[C(W m ) - C(W e )}+] - e 4 ) < H(W\Y e ) 

< MN (E [[C(W m ) - C(W e )}+] + e 6 ) , (21) 

where £4 and £5 vanishes as M, N get large. 

In order to translate H(W*\Y*) to Renyi entropy, to use 
Lemma [9] in our problem, we resort to typical sequences, 
as for a uniform random variable both measures are the 
same. Considering (W^\--- , W^ L \ Y e {1 \ ■ ■ ■ ,Y e {L) ) as L 
repetitions of the experiment of super block random variables 
(W, Y e ), we define the event T based on typical sets as 
follows |16) : Let 5 > 0. T = 1, if the sequences w^ 1 '" L ^ and 



(w 



(l-L) ,=}(!•••£) 



j/e ; ) are <5-typical; and y, 



(l-L) 



is such that the 

probability that (w 1 ^ 1 "' L \ y^} L - ) ) is (5-typical is at least 1 — 5, 



which is taken over w'^ l ' L ^ according to p(W' \y e 
Otherwise, we set T = and denote 60 — Pr{T = 0}. Then, 
by Lemma 6 of fl6l . as L -> 00 



^(l-i),=(l-I,)s 



i^o 0, — > 0, and 

J2(Ty(i-i)|? e (i-i)=5(i-i),T=l) 
> L(H(W\Y e ) - 26) + log(l - <5). 
We continue as_ follows. 

i?(w( 1 - L )|y e (1 - i) = ^ 1 -' L) ,T = i) 

> L(i?(#|f e ) - 25) + log(l - 5) 

> LMn(e [[C(W m ) - C(W e )] + ] - e 4 

25 log(l -<5) N 



(22) 



(23) 



MAT LMN 
= LMN (E [[C(W m ) - C(W e )}+] - 5*) , (24) 

where 5* —> as M,N — > 00. Thus, for the given e*, there 
exists M 2 ,N 2 s.t. for M > M 2 and N > N 2 , ^ > 6*. We let 
r = LMN (E [[C(W rn ) - C(W e )}+} - e*) and consider the 
following bound. 

H(K\Y*,G) >H(K\Y*,G,T) 



(°) \ ^ 

> (!-*o) E v 



[H(K\Y e *=y* e ,G,T = l) 



P(Y e *=y* e \T=l) 



(6) 
> 



(1 - S ) [r 



-LMN(e*-6*) 

ln2 



(25) 



where in (a) 5q is s.t. LSo — > as L —> oo, (b) is due to 
Lemma [9] given above and due to ( l24t and the choice of r. 
Here, for the given e > 0, there exists M3, N3 s.t. for M > M3 

and N > N3, - — [—3 < f ■ Hence, we obtain 

I(K;Y*,G) = H(K)-H(K\Y*,G) (26) 

2-LMN(e*-8*) 

< S Q r + — (27) 

In 2 

(a) 2 -LMN(zl) 

< SqLMN + — (28) 



In 2 



(b) e 
< 5 LMN+-, 



(29) 



where (a) holds if M > M 2 and N > N 2 and (b) holds if 
M > M 3 and N > N 3 . 

Now, we choose some M > max{Mi, M 2 , M3}. For this 
choice of M, we choose sufficiently large L and sufficiently 
large N such that N > max{7Vi, N 2 , N 3 } and 



S LMN < - 
- 2 



LM2 



, N f> 



< e, 



(30) 
(31) 



which holds as 8qL — > as L — > 00 in d22l . (In fact, due 
to Ifl6l Lemma 4 and Lemma 6], for any e' > 0, we can 
take 5qL < ^- as L gets large.) Therefore, for this choice of 
L, M, N, we obtain the desired result from (Q~8]l, (O, d29b , 
due to JIB and d3Tb : 



Pr{VT ^ W*} 
I{K;Y:,G) 



> 
< 
< 



LMN (E [C(W m )] -e*) 



(32) 
(33) 
(34) 



In addition, for this choice of L,M,N, we bound H(K) > 
r — e due to d25l l. which shows that the key is approximately 
uniform. ■ 
Few remarks are now in order. 

1) Existing code designs in the literature and the previous 
section of this work assume that Eve's channel is known at 
Alice and Bob. In the above scheme, Alice and Bob only 
need the statistical knowledge of eavesdropper CSI. Also, the 
main channel is not necessarily stronger than the eavesdropper 
channel, which is not the case for degraded wiretap settings. 

2) The above scheme can be used for the wiretap channel 
of Section [IV] by setting M = to achieve strong secrecy 
(assuring arbitrarily small information leakage) instead of the 
weak notion (making the leakage rate small). See also ifTBTl . 

3) The results can be extended to arbitrary binary-input 
channels along the same lines, using the result of Sec- 
tion [IV] In such a setting, the above theorem would be 
reformulated with n = LMN(E[I(W m )] - e*) and r = 
LMN(E[[I(W m ) - I{W e )] + ] - e*). However, the code con- 
struction complexity of such channels may not scale as good 
as that of the erasure channels [8]. 



VI. Discussion 

In this work, we considered polar coding for binary-input 
DMCs with a degraded eavesdropper. We showed that polar 
coding can be utilized to achieve non-trivial secrecy rates 
these set of channels. The results might be extended to 
arbitrary discrete memoryless channels using the techniques 
given in lfl7l . The second focus of this work was the secret 
key agreement over fading channels, where we showed that 
Alice and Bob can create advantage over Eve by using the 
polar coding scheme at each fading block, which is then 
exploited with privacy amplification techniques to generate 
keys. This result is interesting in the sense that part of the 
key agreement protocol is established information theoretically 
over fading channels by only requiring statistical knowledge 
of eavesdropper CSI at the users. 
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